T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned and Unreviewable Third-Party Python Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 4–13 **Vulnerability Type**: Unpinned third-party dependency and unverifiable supply-chain execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🇺🇸","requires":{"bins":["python3"]},"install":[{"id":"pip","kind":"pip","bins":["python3"],"label":"pip install uscis-case-status"}]}} --- # USCIS Case Status Check USCIS (U.S. Citizenship and Immigration Services) case status by receipt number. Uses Selenium + undetected-chromedriver to scrape the USCIS website. ## Commands ```bash python3 -m uscis_case_status <CASE_NUMBER> ``` ``` ### Technical Analysis The skill directs the environment to install `uscis-case-status` through pip and then execute it as a Python module. The dependency is not constrained to an exact version, package hash, trusted index, or immutable artifact. The project contains only `SKILL.md`; consequently, neither the package implementation nor its transitive dependencies can be reviewed from the supplied artifact. Dependency resolution can therefore select whatever package release is current on the configured package index at installation time. This creates a mutable supply-chain boundary: a compromised maintainer account, malicious future release, package-index compromise, or dependency confusion caused by an untrusted index configuration could change the code executed without any modification to this skill. The package is subsequently invoked directly with `python3 -m uscis_case_status`. At that point, all package initialization and module code runs with the permissions and environmental access of the invoking agent. If pip resolves a source distribution, package build tooling may also execute code during the build process, depending on the package and installer configuration. This finding does not establish that the named package is currently malicious. It establishes that the skill executes an externally maintained, mutab ...[truncated 1544 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `uscis-case-status` to a reviewed, exact version rather than resolving the latest available release. 2. Require cryptographic hashes for the package and every transitive dependency, such as through a hash-locked requirements file and `pip install --require-hashes`. 3. Document and enforce a trusted package index; disable unintended supplemental indexes to reduce dependency-confusion exposure. 4. Include the reviewed implementation in the skill package or link it to an immutable source revision so its runtime behavior can be audited. 5. Generate and retain a dependency lockfile and software bill of materials for all direct and transitive dependencies. 6. Prefer pre-reviewed wheels from a controlled artifact repository. Avoid untrusted source distributions and unnecessary build-time code execution. 7. Run installation and execution as a dedicated, unprivileged account in a sandbox with restricted filesystem, environment-variable, browser-profile, and network access. 8. Add automated dependency integrity, vulnerability, and provenance verification before publishing or installing the skill. ]]>